Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

4.2.1 Testing Environment
Two execution environments, namely Windows and Linux, were tested during the tool
testing. Complete hardware specifications are shown in Table 4.1. A list of support
software that were utilised during the testing is also summarised in Table 4.2. The
software has a hardware incompatibility problem with the hardware resources that
were available; virtualised environment was utilised instead as secondary test
environment to minimise the problem. The hardware specifications of virtualised
environment are based on test station 1.
Table 4.1
Test Stations & Operating Systems
Test Station 1
Windows Environment
Hardware
Intel® Core(TM) i5 CPU 750 @2.67GHz
Gigabyte Motherboard GA-P55A-UD4
BIOS version F6
On board USB 2.0, USB3.0, Ethernet, SATA
and PATA controllers
Texas Instruments 1394 OHCI Host
controller
4GB Ram
ASUS DVD-RW DRW-24B1ST ATA Device
SAMSUNG HD103SJ SATA drive 1TB
72
Test Station 2
Linux Environment
Hardware
Intel® Core2(TM) CPU 6300
@1.86GHz
EPox 5P965 Motherboard
On board USB 2.0, Ethernet, SATA and
PATA controllers
1.44 MB floppy drive
3GB Ram
Pioneer DVD-RW DVR-111D ATA
device
Seagate ST3250823AS SATA drive
250Gb
Operating Systems & Test Cases Involved
Windows 7- 32bits
All test cases of FTK Imager
Helix (TC-02 NFTS, TC-05, TC-07, TC-08, TC-17, TC-18)
Windows XP SP3 with latest system updates or Virtualised Windows XP SP3
Helix (TC-01 USB, TC-14, TC-15, TC-16, TC-18)
Live CD Environment
Helix (All TC-01 except TC-01 USB, All TC-02 except TC-02 NTFS, TC-03, TC-
06, TC-12, TC-13
Ubuntu 9.04 LTS
All test cases of AIR
Most of the test cases followed the generic procedures: reset test drive, partition drives
if required, acquire test drive using disk imaging tools and verify the results. Test